All Apps and Add-ons

How to get the Splunk Add-on for Nessus to pull data older than the current month from my scanner?

donaldwayne1975
Path Finder

Recently installed the Splunk Add-on for Nessus and have it successfully pulling data from my scanner. It is only showing scan data for the current month though. Is there a way to have it pull data further back. Nessus version is 6.5.2 and Splunk version 6.2.0.237341. Thank you in advance for your time.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

The start_date parameter (called Start Time in the input UI if you are doing this in Splunk Web) is intended to control this. It should be pulling all scan data with a "host scan date" in Nessus later than the time you specify. Keeping the default of 1999/01/01 should collect everything. If that doesn't seem to be working as expected, please file a support case and send a diag so we can take a look.

0 Karma

donaldwayne1975
Path Finder

I have adjusted this value a couple of times, followed by a restart of the service. I have seen one additional day worth of data from 2 months prior be populated into Splunk. Odd that it is not pulling the other days scan data. I am seeing these errors in the log.

ERROR pid=5600 tid=MainThread file=nessus_config.py:check_conf_mgr_result:26 | Cannot get the encrypted keys.

ERROR pid=5600 tid=MainThread file=nessus.py:get_nessus_modinput_configs:156 | Failed to setup config for nessus TA: Cannot get the encrypted keys.

AND

ERROR pid=5600 tid=MainThread file=nessus.py:get_nessus_modinput_configs:157 | Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\nessus.py", line 147, in get_nessus_modinput_configs
input_conf = config.get_data_input(input_name)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...